Procedure examples

MuddyWater has run tools including Browser64 to steal passwords saved in victim web browsers.

MuddyWater has used malware that has the capability to execute malicious code via COM, DCOM, and Outlook.

MuddyWater has used malware that can execute PowerShell scripts via DDE.

MuddyWater has used the native Windows cabinet creation tool, makecab.exe, likely to compress stolen data to be uploaded.

MuddyWater has sent phishing emails to targets from the email address support@microsoftonlines[.]com.

MuddyWater has compromised third parties and used compromised accounts to send spearphishing emails with targeted attachments to recipients. MuddyWater has also sent spearphishing emails with the attachment Cybersecurity.doc, which served as the primarily payload for the next stage.

MuddyWater has sent targeted spearphishing e-mails with malicious links.

MuddyWater has attempted to exfiltrate data to Wasabi, a cloud storage service, using Rclone.

MuddyWater has used ports 8043 and 8848 for botnet C2 communication.

MuddyWater has used AES to encrypt C2 responses.

MuddyWater maintains persistence on victim networks through side-loading dlls to trick legitimate programs into running malware.

MuddyWater has established domains, some of which appeared to spoof legitimate domains for use in operations.

MuddyWater has used file sharing services including OneHub, Sync, and TeraBox to distribute tools.

MuddyWater has used publicly available malware for operations, likely to blend in with other cybercriminals.

MuddyWater has used legitimate tools ConnectWise, RemoteUtilities, and SimpleHelp to gain access to the target environment.

MuddyWater has mapped target networks; access to this information and more is then shared/sold to other Iran threat actors.

MuddyWater has used support@microsoftonlines[.]com to send phishing emails that masqueraded as security updates from Microsoft. MuddyWater has also impersonated TMCell (Altyn Asyr CJSC), the primary mobile operator in Turkmenistan, sending phishing emails with the email domain info@tmcell.

MuddyWater can disable the system's local proxy settings.